fix(dev): serve the error channel to remote peers, scoped

[danielroe]

🔗 Linked issue

📚 Description

implements danielroe/my-bad#46

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	my-bad@​0.2.5 ⏵ 0.2.6	+2		+1	+1

View full report

[pkg-pr-new]

• nuxt-cli-playground

  npm i https://pkg.pr.new/create-nuxt@1554
  

  npm i https://pkg.pr.new/nuxi@1554
  

  npm i https://pkg.pr.new/@nuxt/cli@1554
  

commit: f5100a8

[github-actions]

CLI benchmark

@nuxt/cli v4.0.0-alpha.1 (baseline) vs v4.0.0-alpha.1 (this PR)

Metric	baseline v4.0.0-alpha.1	head v4.0.0-alpha.1	Delta
nuxt --version wall time (median)	69 ms	69 ms	+0.0%
nuxt --help wall time (median)	147 ms	146 ms	-0.3%
nuxt dev --help wall time (median)	113 ms	112 ms	-0.9%
nuxt --version modules loaded	37	37	0.0%
nuxt --help modules loaded	139	139	0.0%
nuxt dev --help modules loaded	82	82	0.0%
Installed node_modules	2.38 MB	2.38 MB	-0.0%
Published tarball (packed)	232.0 kB	231.6 kB	-0.1%

Full report

@nuxt/cli v4.0.0-alpha.1 (baseline) vs v4.0.0-alpha.1 (head)

Setting	Value
Baseline	ref:ef6a852102a7035ec10e4daa178e5df811a216e0 (v4.0.0-alpha.1)
Head	local packages/nuxt-cli at 8de67fb (v4.0.0-alpha.1)
Node	v24.21.0
OS	Linux 6.17.0 (kernel 6.17.0-1022-azure)
CPU	AMD EPYC 9V74 80-Core Processor x 4
Memory	15.6 GB
Load average at start	1.03, 0.29, 0.10
Run started	2026-09-22T10:13:43.173Z

Cold CLI startup

Median of 15 interleaved runs per command, one warmup discarded.

Command	baseline v4.0.0-alpha.1 median	head v4.0.0-alpha.1 median	Delta	baseline v4.0.0-alpha.1 min / p95	head v4.0.0-alpha.1 min / p95
nuxt --version	69 ms	69 ms	+0.0%	67 ms / 73 ms	68 ms / 71 ms
nuxt --version (first output byte)	64 ms	64 ms	+0.0%	62 ms / 68 ms	63 ms / 66 ms
nuxt --help	147 ms	146 ms	-0.3%	144 ms / 150 ms	143 ms / 149 ms
nuxt --help (first output byte)	141 ms	140 ms	-0.4%	139 ms / 144 ms	137 ms / 143 ms
nuxt dev --help	113 ms	112 ms	-0.9%	110 ms / 116 ms	109 ms / 116 ms
nuxt dev --help (first output byte)	107 ms	107 ms	-0.6%	104 ms / 111 ms	103 ms / 111 ms
nuxt <unknown-command> (no-op)	157 ms	157 ms	-0.0%	153 ms / 160 ms	152 ms / 159 ms
nuxt <unknown-command> (no-op) (first output byte)	151 ms	150 ms	-0.5%	148 ms / 154 ms	146 ms / 153 ms

Module load cost

Counted with a module.registerHooks load hook, compile cache disabled. Counts every JS module actually evaluated on that code path (built-ins excluded, native addons excluded).

Command	baseline v4.0.0-alpha.1 modules	head v4.0.0-alpha.1 modules	Delta	baseline v4.0.0-alpha.1 source bytes	head v4.0.0-alpha.1 source bytes	Delta
nuxt --version	37	37	0.0%	302.8 kB	302.8 kB	0.0%
nuxt --help	139	139	0.0%	1.03 MB	1.03 MB	-0.1%
nuxt dev --help	82	82	0.0%	645.9 kB	645.3 kB	-0.1%

Install footprint and published tarball

Each version installed on its own into an empty project with nothing but @nuxt/cli as a dependency, so the tree is exactly the CLI and its transitive dependencies. npm cache is warm and the registry is only consulted for metadata, so install wall time is indicative, not a network benchmark.

Metric	baseline v4.0.0-alpha.1	head v4.0.0-alpha.1	Delta
Direct dependencies of @nuxt/cli	22	22	0.0%
Packages in the installed tree (unique name@version)	38	38	0.0%
Unique package names	38	38	0.0%
Package directories on disk (cross-check)	31	31	0.0%
Installed node_modules on disk	2.38 MB	2.38 MB	-0.0%
Installed files	407	407	0.0%
Install wall time (warm npm cache, median of 3)	1.29 s	1.29 s	-0.2%
Published tarball (packed)	232.0 kB	231.6 kB	-0.1%
Published tarball (unpacked)	757.3 kB	756.7 kB	-0.1%
Files in tarball	84	84	0.0%

Interleaved runs on a shared runner: trust the deltas, not the absolute timings. The dev, restart and build suites run locally via pnpm bench:cli.

[vercel-security-reviewer]

Security review details

[codspeed]

Merging this PR will not alter performance

✅ 2 untouched benchmarks

---

_{Comparing scoped-error-channel (f5100a8) with main (ef6a852)}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 5b6887bf-4299-4a5b-9910-6ee7b187b3de

📥 Commits

Reviewing files that changed from the base of the PR and between ef6a852 and f5100a8.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (5)

• packages/nuxt-cli/package.json
• packages/nuxt-cli/src/dev/error-channel.ts
• packages/nuxt-cli/src/dev/utils.ts
• packages/nuxt-cli/test/unit/error-channel.spec.ts
• pnpm-workspace.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The error channel now accepts remote requests and passes a trusted flag based on the peer address. Remote peers can stream events and access history only with the matching request ID. Open-in-editor requests remain denied remotely. Loopback peers retain full access. The my-bad dependency and workspace exclusion list now reference version 0.2.6.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to f5100

Remote peers receive scoped error-channel access while loopback peers retain privileged access; no concrete merge-blocking risk is established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes serving the development error channel to remote peers with scoped access.
Description check	✅ Passed	The description identifies the implemented change and links it to the related upstream pull request.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (2 skipped: 2 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}